#1136 Route `osctrl-tls` lag-tolerant reads to the DB read replica Pull request opened by javuto Route osctrl-tls lag-tolerant reads to the DB read replica Problem osctrl-tls accepted the read replica setting and connected to it, but sent every read to the primary. It logged a warning saying so. Change osctrl-tls now uses the explicit

Replica()

pattern for two background read paths that tolerate replication lag. With the replica off, behaviour is unchanged. Routed to the replica • Alert rule node scans: the per-environment active and inactive node scans behind the node alert rules (

tls_alerts.go

). Environment and inactivity-threshold settings still come from the primary. • osctrld Prometheus gauges:

osctrld_osquery_down

,

osctrld_osquery_behind

and

osctrld_osquery_rollout_paused

. The collectors get replica copies of their managers. New

Replica()

methods • `nodeconfig.FlagsManager.Replica()`: no cache. •

osqueryversions.Manager.Replica()

. Stays on the primary: enrollment, node-key lookups, config and log posts, distributed query reads, carves, and osctrld status reports and rollout decisions. osctrl-api follow-up:

PostureManager.ReadEvidence

is set to the replica-backed vulnerability reader. The posture replica copy uses it, so node-list risk levels read both posture rows and findings from the replica. Docs: • ARCHITECTURE.md describes the read replica and the routing rule. • The

db.read

comment in

tls.yml

and the

--db-read-enabled

help text list what each service routes. • The startup warning that osctrl-tls routed nothing is replaced by an info line. Security and operational impact • Only background and metrics reads move. Nothing on the osquery or osctrld request path changes. • Under heavy replication lag, the alert scans and gauges may briefly reflect older data. Inactivity thresholds are measured in hours, so ordinary lag can't make a checking-in node look inactive. Validation •

go vet ./...

and

go test ./...

pass. • New tests: •

FlagsManager.Replica()

reads osctrld status counts from the replica without the cache, while the manager keeps the primary; •

osqueryversions.Manager.Replica()

does the same for paused-rollout counts; • the TLS alert node source reads node rows from the replica and environments from the primary; •

PostureManager.Replica()

prefers

ReadEvidence

. • Not validated against a real Postgres or MySQL replica. jmpsec/osctrl